Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an application which logs to syslog facility local1. I would like to configure syslog to send all local1 messages to a log file separate from /var/log/messages -- that turned out to be easy. But the messages are also going to /var/log/messages. is there some way to tell syslog to send *.info to /var/log/messages but exclude local1.info? (Something like *^loacl1.info ?)

syslog.conf:

#kern.*                                                 /dev/console

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

authpriv.*                                              /var/log/secure

local0.notice;local0.debug;mail.*;mail.none;mail.info;local0.info /var/log/maillog

cron.*                                                  /var/log/cron

*.emerg                                                 *

uucp,news.crit                                          /var/log/spooler

local7.*                                                /var/log/boot.log

#My Custom App Logging
local1.*                                             /var/log/application.log
share|improve this question

1 Answer 1

up vote 6 down vote accepted

Try replacing

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

by

*.info;mail.none;authpriv.none;cron.none;local1.!=info                /var/log/messages

This will log message that match : any facility with level info AND facility not mail AND facility not authpriv AND facility local1 execpt when level is info.

share|improve this answer
    
That did it, thanks! –  Josh Jul 24 '09 at 22:21
    
Ah ha -- thanks to your edited post I now see what I want is local1.none, not local1.!=info. I didn't realize what the behavior of .none was. –  Josh Jul 24 '09 at 22:23
1  
@Radius: Shouldn't that be 'local1.none', not 'local1.!=info'? Also, I believe that 'local1.!=info' doesn't work with all Syslog daemons. 'local1.none' is more universal. –  Stefan Lasiewski Apr 30 '10 at 17:14
2  
@Stefan, the original request was to exclude local1.info not all local1 message. So local1.!=info is the right syntax. But in fact Josh need was to exclude all local1 messages (from his comment), so in this case local1.none is the right syntax –  radius Apr 30 '10 at 23:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.